Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TODO: ARM64 support #4

Open
nomi-san opened this issue Jul 13, 2022 · 0 comments
Open

TODO: ARM64 support #4

nomi-san opened this issue Jul 13, 2022 · 0 comments
Labels
enhancement New feature or request

Comments

@nomi-san
Copy link
Collaborator

Let a method template like this:

void foo() {
    volatile size_t self = 0xFFFFFFFFFFFFDEAD;
    printf("self: %p\n", (void *)self);
}

// mov	x0, #0xDEAD
// movk	x0, #0xFFFF, lsl #16
// movk	x0, #0xFFFF, lsl #32
// movk	x0, #0xFFFF, lsl #48
// str  x0, [sp, #24] 

Finding offset:

for (offset = 0; offset < LIMIT; offset++)
  if ((ip[offset] >> 24) == 0xD2)       // MOV
    if (ip[offset + 1] >> 24) == 0xF2)  // MOVK
      if (((ip[offset] >> 5) & 0xFFFF) == 0xDEAD)
        // found

Patching self data:

mov   ?, [data & 0xFF]
movk  ?, [data >> 16], lsl #16
movk  ?, [data >> 32], lsl #32
movk  ?, [data >> 48], lsl #48
; str   ?, [sp, ?] 

Trampoline:

; addr = proto + offset + 2 * sizeof(uint32_t)   // 32bit fixed length instruction
mov   x9, [addr & 0xFF]
movk  x9, [addr >> 16], lsl #16
movk  x9, [addr >> 32], lsl #32
movk  x9, [addr >> 48], lsl #48
br    x9

Result:

foo2 = bind(foo, 0xdeadbeef);
foo2();
// self: deadbeef
@nomi-san nomi-san added the enhancement New feature or request label Jul 13, 2022
@nomi-san nomi-san changed the title Todo: Arm64 support TODO: ARM64 support Oct 18, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Development

No branches or pull requests

1 participant